Your two-factor codes, encrypted on your own device.

2FA Keyring is a free, open-source authenticator that runs entirely in your browser. There's no account to create, and your keys never go to a server. They stay on your device, locked with a passphrase that only you know.

Open the app Read the security model
  • AES-256-GCM
  • PBKDF2 · 600,000 rounds
  • Network calls blocked
  • No cookies or analytics

Works with any service that offers "authenticator app" codes, such as GitHub, Google, Microsoft, AWS, Discord and Dropbox.

Your keys ● Encrypted
  1. Example ASHA-1 · 6 digits · 30 s --- ---
  2. Example BSHA-256 · 8 digits · 30 s ---- ----
  3. Example CSHA-512 · 6 digits · 60 s --- ---
These codes are live, calculated in your browser right now from the public test keys in RFC 6238. They aren't real accounts.

What happens to your keys

Encrypted before they're stored. Never sent by the app.

Every key you add goes through the same path, inside your browser, before anything is written to disk.

  1. You typeYour passphrase

    It's never stored or sent anywhere. It exists only in memory while you unlock the vault.

  2. Key derivationPBKDF2-SHA256

    600,000 rounds with a random 16-byte salt slow down anyone trying to guess your passphrase.

  3. EncryptionAES-256-GCM

    Your keys are sealed with a fresh random IV on every save. Any tampering makes decryption fail.

  4. StorageThis browser only

    Only the encrypted vault is saved, in this browser's local storage. It never reaches a server.

Network connections blocked by your browser

The app's Content Security Policy sets connect-src 'none', so your browser blocks the page from opening network connections of any kind (fetch, XHR, WebSockets and beacons). All code and fonts come from this site, with no CDNs, trackers or third-party scripts. This is a strong safety net, not a substitute for trustworthy code, which is why the code is open for anyone to read.

The exact policy the app runs under. You can check it with View Source.

default-src 'none';  script-src 'self';  style-src 'self';
font-src 'self';  img-src 'self' blob:;  connect-src 'none';
base-uri 'none';  form-action 'none';  object-src 'none';  worker-src 'none'

Honest limits

What it protects against, and what it can't

No authenticator can protect you from everything. Here's exactly where the line is.

Protected

  • A stolen backup file or browser profileWithout your passphrase, the vault is unreadable ciphertext.
  • A breach of the website's hostThe host only stores the public site files. Your keys and passphrase never reach it.
  • Tracking and data collectionNo accounts, cookies or analytics, and no network requests from the app once it has loaded.
  • Someone walking up to your screen laterAuto-lock clears the decrypted keys from memory after inactivity, or as soon as you switch tabs.
  • Being loaded inside another siteThe app refuses to run inside a frame, so it can't be overlaid to trick your clicks.

Not protected

  • A weak passphraseEncryption is only as strong as your passphrase. The app requires 12 or more characters and rejects easy ones.
  • Malware or a malicious browser extensionSoftware on your device can read the page while it's unlocked, as with any password manager.
  • A forgotten passphraseThere's no reset and no back door. Keep your services' recovery codes somewhere safe.
  • Clearing your browser dataThat deletes the vault. Export an encrypted backup after adding keys.
  • What the host can seeLike any website, the host (GitHub or Cloudflare) sees that your IP address requested the site's files. It never sees anything you type.

Getting started

Set up in under two minutes

  1. Create your vault

    Choose a passphrase of at least 12 characters. Four or more random words work well. It encrypts everything that follows.

  2. Add your keys

    When a service shows a QR code for an authenticator app, paste the setup key or the otpauth:// link, or upload a screenshot of the QR code. You can add several at once.

  3. Back up, then sign in

    Export an encrypted backup and store it somewhere safe. From then on, open the app, unlock it and click a code to copy it.

Features

Everything an authenticator needs, nothing it doesn't

Live codes with countdown
Each code shows the time left, and the next code appears just before it changes.
Every common format
SHA-1, SHA-256 and SHA-512, with 6, 7 or 8 digits and any period from 1 to 300 seconds.
Three ways to add keys
Type the setup key, paste otpauth:// links, or upload QR screenshots. The QR codes are decoded on your device.
Encrypted backups
Export to a file or as text, restore on another device, or merge with an existing vault.
Auto-lock
Locks after 1, 5 or 15 minutes of inactivity, and optionally as soon as you leave the tab.
Works offline
Codes depend only on your key and your clock, so no connection is needed once the page has loaded.

Questions

Frequently asked

Can anyone else see my keys, including the people who run this site?

No. Your keys are encrypted in your browser and saved only on your device. The site is just static files with no backend to receive them, and the app's security policy blocks network connections.

As with any website, the company hosting the files can see that your IP address loaded them, but nothing you type or store is ever sent.

What happens if I forget my passphrase?

The vault can't be opened, by you or by anyone else. That's what keeps it secure. Use each service's recovery codes to sign in and set up two-factor again, then create a new vault.

How do I move my keys to a new computer or phone?

In the app, open Backup and save the encrypted backup file. On the new device, open the app, choose "Restore from an encrypted backup", and enter the passphrase the backup was made with.

Why does my vault disappear in a private window?

Private windows erase local storage when they close, and each browser keeps its own vault. Use a normal window, and keep a backup.

My codes are rejected. What's wrong?

Time-based codes depend on your device's clock. Make sure your clock is set automatically. If a service uses non-default settings, check the key's Advanced options (algorithm, digits, period) against what the service shows.

How can I check these claims myself?

Open your browser's developer tools on the app and watch the Network tab while you use it: you'll see only this site's own files. The full source is on GitHub, and the security page lists step-by-step checks.

Is it free?

Yes. There's no account, no subscription and no ads.

Your keys, your device, your passphrase.

Open 2FA Keyring View the source